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Foreword from The Information Commissioner 



On 10 May 2006 I put a special report before Parliament using, for the first 
time, powers granted to the Information Commissioner under 
the Data Protection Act 1998. Titled 'What price privacy?' 1 the report 
exposed an extensive illegal trade in confidential personal information and 
made recommendations to government and industry in an effort to 
halt a serious threat to individuals' privacy. Some of the press coverage 
since the report has highlighted the intrusion into the lives of high 
profile public figures by the media but it should not be forgotten that this trade also affects 
the lives of people not in the public eye and is very often unrelated to media activity. 

Respect for privacy is one of the foundation stones of the modern democratic state. It is enshrined 
in the European Convention on Human Rights and is directly enforceable in UK courts through 
the Human Rights Act 1998. Failure to respect an individual's privacy can lead to distress and in 
certain circumstances can cause that individual real damage, mentally, physically and financially. 

People care about their personal privacy and have a right to expect that their personal details 
are and should remain confidential. Who they are, where they live, who their friends and family 
are, how they run their lives: these are all private matters. Individuals may choose to divulge 
such information to others, but information about them held confidentially by others should 
not be available to anyone prepared to pay the right price. 

The recommendations in the report sought to tackle the illegal trade in personal information 
on a number of levels. The main recommendation was the introduction of a two year 
prison sentence but it also called for the key players to take steps to reduce demand and 
raise awareness of the problem. 

In the report I stated my intention to review the progress made after six months and detail 
the responses from the many bodies identified as having a role to play. Progress has 
been significant and encouraging. In particular I welcome the Government's consultation on 
increased sentences. Overwhelmingly the responses indicate support for the proposals. 
Many organisations have taken steps of their own to raise awareness and tighten security as 
well as more generally condemning the illegal trade. The majority of the responses and 
steps taken are to be commended and clearly demonstrate an understanding and commitment 
to deal with this problem. A few responses have been less encouraging. Here my office will 
continue to raise awareness and develop support for our proposals. 

There is though much for us to be pleased about. I wish to thank all parties that have 
co-operated with my office to reach the stage that we are at today. 




Richard Thomas 

Information Commissioner 




1 HC1056. 



Introduction 



In May 2006 the Information Commissioner put a special report before Parliament using 
powers granted to him under Section 52(2) of the Data Protection Act 1998. Titled 
'What price privacy?' the report exposed an extensive illegal trade in confidential personal 
information and made recommendations to government and industry to try and halt a 
serious threat to individuals' privacy. In the report the Information Commissioner stated 
his intention to review the progress made after six months and detail the responses 
from the many bodies identified as having a role to play. The purpose of this follow up 
report is to document the review and summarise the responses received. 



What price privacy? 

'What price privacy?' revealed evidence of systematic breaches in personal privacy 
that amount to an unlawful trade in confidential personal information. Putting a stop to 
this trade was its primary purpose. 

Public bodies holding personal information about individuals include government 
departments and agencies, local authorities, the National Health Service and the police. 
In the private sector, banks and other financial institutions, supermarkets, 
telecommunications providers and transport operators may all hold increasing amounts 
of information about individuals. 

Government initiatives look set to increase the amount of information collected and 
shared centrally, and to make it easier for individuals to gain access to their own personal 
details. Such moves inevitably increase the risk of security breaches by third parties. 
It is encouraging that these risks are appreciated by government. The Chief Executive of 
the NHS Connecting for Health project was amongst the first to support publicly the 
Commissioner's call for deterrent jail sentences. 

Protection is offered in law by Section 55 of the Data Protection Act 1998, which 
makes it an offence (with certain exemptions) to obtain, disclose or procure the 
disclosure of personal information knowingly or recklessly, without the consent of the 
organisation holding the information. Offences are punishable by a fine only: up to 
£5,000 in a Magistrates' Court and unlimited in the Crown Court. 

Since the Act came into force, the Information Commissioner's Office (ICO) has 
received a steady number of complaints from individuals who feel their privacy has 
been breached. Many more cases come to the attention of the ICO through joint 



working protocols with bodies such as the Department for Work and Pensions, HM 
Revenue & Customs and police forces around the country. 

Much more illegal activity lies hidden under the surface. Investigations by the ICO and 
the police have uncovered evidence of a widespread and organised undercover market 
in confidential personal information. Such evidence formed the core of the report, 
detailing how the unlawful trade in personal information operates: who the buyers 
are, what information they are seeking, how that information is obtained for them, and 
how much it costs. 

Among the ultimate 'buyers' are many journalists looking for a story. In one major case 
investigated by the ICO, the evidence included records of information supplied to 305 
named journalists working for a range of newspapers. Other cases have involved 
finance companies and local authorities wishing to trace debtors; estranged couples 
with one party seeking details of their partner's whereabouts or finances; and 
criminals intent on fraud or witness or juror intimidation. 

The personal information they are seeking may include someone's current address, 
details of car ownership, an ex-directory telephone number or records of calls made, 
bank account details or intimate health records. Disclosure of even apparently 
innocuous personal information - such as an address - can be highly damaging in some 
circumstances, and in virtually all cases individuals experience distress when their 
privacy is breached in this way. 

'What price privacy?' described the most likely scenarios where confidential information 
may be obtained illegally and illustrated them with real cases that the Information 
Commissioner has investigated. 2 The 'suppliers' almost invariably work within the 
private investigation industry: private investigators, tracing agents, and their operatives, 
often working loosely in chains that may include several intermediaries between the 
ultimate customer and the person who actually obtains the information. 

Suppliers use two main methods to obtain the information they want: through 
corruption, or more usually by some form of deception, generally known as 
'blagging'. Blaggers pretend to be someone they are not in order to wheedle out the 
information they are seeking. They are prepared to make several telephone calls 
to get it. Each call they make takes them a little further towards their goal: obtaining 
information illegally which they then sell for a specified price. Records seized 
under search warrants show that many private investigators and tracing agents are 
making a lucrative business out of this trade. 



2 Paragraph 5.22 of 'What price privacy?' referred to a case involving the Royal Mail that was not prosecuted because of insufficient 
evidence. The Information Commissioner has accepted the Royal Mail's assertion that they were not the source of the leaked information. 



To date prosecutions brought under the Act have generally resulted in low penalties: 
either minimal fines or conditional discharges. 'What price privacy?' reported that between 
November 2002 and January 2006, only two out of 22 cases produced total fines 
amounting to more than £5,000. 3 Other investigations led to frustrating outcomes, 
despite the detriment caused to individuals and to public confidence generally. Since the 
publication of 'What price privacy?' there have been two further successful prosecutions 
under Section 55 and a further individual cautioned. These have resulted in fines ranging 
between £3,300 and £4,200. At the time of writing one case is awaiting sentencing. 

The report's central recommendation called on the Lord Chancellor to bring forward 
proposals to raise the penalty for persons convicted on indictment of Section 55 
offences to a maximum two years imprisonment, or a fine, or both; and for summary 
convictions, to a maximum six months imprisonment, or a fine, or both. The aim 
of a custodial sentence is to discourage this undercover market and to send out a clear 
signal that obtaining personal information unlawfully is a crime. 

To stifle demand for confidential personal information the report issued a warning 
to all businesses and individuals obtaining, supplying or buying personal information, 
that they should restrict themselves to information which they are confident 
has been lawfully obtained. 

The report also identified and made recommendations to other main players; 
the Security Industry Authority, the Association of British Investigators, the Press 
Complaints Commission and the Office of Fair Trading. 

The report invited a number of named media, financial and professional bodies to respond 
to specific questions about the steps they will take to help raise awareness and 
encourage good practice. The report also invited responses and further evidence from 
consumer and citizens' organisations. 



Developments since May 2006 

Since the publication of 'What price privacy?' events have further highlighted the 
illegal trade in confidential personal information. These continue to demonstrate 
the need for a strong deterrent and greater awareness and control by organisations. 

In the news 

In August 2006 two men including a prominent journalist were arrested and charged 
with the illegal interception of communications and conspiracy offences. 



3 Whilst in May 2004 Peter Bascombe and Brays Detective Agency Limited were prosecuted, they were both acquitted at trial. 



This followed an inquiry into the illegal interception of phone messages of members 
of the royal family, other high profile figures and celebrities. The charges have 
been brought under the Regulation of Investigatory Powers Act 2000 and other 
legislation but the circumstances appear to have parallels with the Section 55 offence 
and to reinforce the evidence gathered during Operation Motorman. In November 2006, 
both men pleaded guilty to conspiracy to intercept voicemail messages and one has 
pleaded guilty to intercepting voicemail messages. Sentencing will take place in 2007 



In September 2006 Hewlett Packard Chairwoman Patricia Dunn was forced to step down 
after it emerged that investigators appointed by her to look into a leak in the HP boardroom 
had obtained the phone records of a number of journalists and fellow directors in 
the United States. In a classic case of blagging - known as 'pre-texting' in the USA - the 
investigators impersonated the journalists to dupe the phone companies into providing 
the information. The damage to the reputation of Hewlett Packard and the subsequent 
resignation of Patricia Dunn clearly demonstrate the risks that any reputable company 
takes in making use of private information obtained by illegal means. 



At the Information Commissioner's Office 

The Information Commissioner's Regulatory Action Division has continued their investigation 
and prosecution of Section 55 offences. Since May 2006 the Information 
Commissioner has brought two successful prosecutions under Section 55 and 
a further individual has accepted a caution. 



Case 1 - An individual that was not involved in the private investigation industry 

accepted a caution for an offence under Section 55 of the Data Protection 

Act 1998 for information obtained from a financial institution about their spouse. 



Case 2 - On 3 November 2006 Anthony Gerald Clifford pleaded guilty to 16 
Section 55 offences and is expected to be sentenced in December 2006. 

Mr Clifford of Chessington in Surrey ran a private investigation agency trading as 
MRS. Mr Clifford obtained and sold information on a number of individuals. 
In addition he pleaded guilty to a number of offences of procuring disclosure of 
information contained in personal data to another person. Mr Clifford engaged in 
blagging techniques including impersonating individuals to obtain their information. 
If his target was a woman he would have a female employee of his make the 
pretext call on his behalf, she has been cautioned for her involvement. 



Case 3 - On 14 November 2006 Stephen and Sharon Anderson of 

St Ives in Cambridgeshire pleaded guilty to obtaining and selling information 

unlawfully whilst operating as private investigators. 

Mrs Anderson pleaded guilty to 14 offences asking for a further 51 offences 

to be taken into consideration. Mr Anderson pleaded guilty to 11 offences 

and asked for a further 46 offences to be taken into consideration. Mrs Anderson 

was fined a total of £4,200 and Mr Anderson was fined £3,300. 

Each was ordered to pay a contribution to prosecution costs of £3,694. 

The couple used 'blagging' techniques to obtain and attempt to obtain personal 
information about individuals from a number of organisations including 
Her Majesty's Revenue and Customs, British Telecommunications pic and various 
banks. On a number of occasions the 'blaggers' purported to be employees 
of these organisations and deceived the true members of staff into disclosing 
personal information about individuals. 

The evidence gathered by the ICO showed that the couple had obtained 
account details, income tax information and telephone numbers relating to 
a number of different 'victims'. 

'What price privacy?' reported that 305 journalists had been identified during Operation 
Motorman as customers driving the illegal trade in confidential personal information. 
Following the report the Information Commissioner received a request under the 
Freedom of Information Act 2000 for further information about the publications that 
the 305 journalists were employed by and a breakdown of their activity. After 
considering the relevant exemptions information which did not identify the journalists or 
the publications was provided to the requester. 

Having considered the matter further the Information Commissioner has decided that 
a further disclosure is in the public interest and in the context of a special report to 
Parliament is consistent with the discharge of his functions under the Data Protection 
Act 1998. The following table shows the publications identified from documentation 
seized during the Operation Motorman investigation, how many transactions each 
publication was positively identified as being involved in and how many of their 
journalists (or clients acting on their behalf) were using these services. 

It should be noted that while the table is dominated by tabloid publications they are far 
from being alone. Certain magazines feature prominently and some broadsheets are 
also represented. The Commissioner recognises that some of these cases may have raised 
public interest or similar issues, but also notes that no such defences were raised by any 
of those interviewed and prosecuted in Operation Motorman. 




Number of Number of 

transactions positively journalists/clients 
identified using services 



Daily Mail 
Sunday People 
Daily Mirror 
Mail on Sunday 
News of the World 
Sunday Mirror 
Best Magazine 
Evening Standard 
The Observer 
Daily Sport 
The People 
Daily Express 
Weekend Magazine (Daily Mail) 
Sunday Express 
The Sun 

Closer Magazine 
Sunday Sport 

Night and Day (Mail on Sunday) 
Sunday Business News 
Daily Record 
Saturday (Express) 
Sunday Mirror Magazine 
Real Magazine 
Woman's Own 
The Sunday Times 
Daily Mirror Magazine 
Mail in Ireland 
Daily Star 
The Times 
Marie Claire 
Personal Magazine 
Sunday World 



952 
802 
681 
266 
228 
143 
134 
130 
103 
62 

37 

36 
30 
29 
24 
22 

15 

9 

8 

7 




58 
50 
45 
33 
23 
25 
20 
1 
4 
4 
19 
7 
4 
8 
4 
5 
1 
2 
1 
2 



Media coverage 

'What price privacy?' attracted widespread interest from all media channels. With some 
journalists implicated as 'buyers' in the report, the Information Commissioner wondered 
whether some media groups might avoid reporting the story. To a certain extent this 
proved to be the case as coverage even in the broadsheets at the time of publication 
was limited. However, all broadsheets featured details of the report on their websites. 

Despite this there has been a growing and now substantial level of positive press 
coverage since the launch of 'What price privacy?'. Over the past six months 32 
national press articles have featured the report and highlighted the widespread illegal 
trade in personal information. Trade and regional press coverage has also been 
extremely encouraging with 54 trade and 43 regional articles covering the report. 

'What price privacy?' was also covered by the broadcast media. The report's launch was 
featured extensively on Radio 5 Live and a subsequent news feature in August focused 
on the personal stories of the 'victims' of blagging. The Information Commissioner's 
call for a custodial sentence for those convicted under Section 55 of the Data Protection 
Act was highlighted on the Today programme, BBC Breakfast and the lunchtime 
and evening news. There was also a strong interest from the regional BBC stations. 

Of particular note was the difference of approach taken by some media commentators 
to breaches of the law by journalists and breaches of the law by others. Whilst largely 
commending the Information Commissioner for seeking to clamp down on private 
investigators acting on behalf of the financial institutions, the legal profession and others 
they suggested in some cases that, despite the existence of public interest defence, 
journalists should be treated differently. It is important to point out that the Information 
Commissioner is not proposing to criminalise any conduct that is not already against 
the law. There is no suggestion that the action of a journalist or private investigator in 
seeking information from public sources or friends and neighbours to pursue a story should 
be made illegal. However, journalists (and many others) who either directly or through 
middlemen obtain personal information from public and private sector organisations 
by bribery, impersonation and similar means are engaging in conduct which, unless they 
can clearly demonstrate a public interest, has quite rightly been illegal since 1994. 

We estimate that news of the report has reached an audience of over 30 million. 



the press 



"People who buy and sell unauthorised personal 
information should face up to two years in prison rather 
than a fine, the Information Commissioner has said." 

Financial Times, 12 May 



"Crooks who peddle our personal or financial records should 
be jailed for up to two years, says a Government watchdog." 



J 



The Sun, 13 May 2006 



"Richard Thomas this week became the first commissioner to 
use his special powers under the Data Protection Act to present 
a report to Parliament warning of the 'pernicious' and 
'pervasive' trade in data." 

www.techworld.com, 17 May 2006 



"The British state presents a menace to individual privacy 
in the 21st century in two ways, as the Information 
Commissioner demonstrates in his commendably clear 
report, What Price Privacy?" 

The Observer, 28 May 2006 



"This is an example of a robust authority giving evidence of 
a problem, showing the consequences and recommending a 
course of action," eulogises Dahlberg [Chairman of the Security 
Industry Authority]. "That is the powerful way to make policy 
happen if you want to drive it." 



Security Management Today, 1 June 2006 



"The NUJ has defended the right of journalists to use all 
reasonable means in the pursuit of the truth where the public 
interest is at stake" ..."General secretary Jeremy Dears said all 
union members agreed to abide by the NUJ code of conduct 
that stresses that only straightforward means of obtaining 
information should be used unless overriding considerations of 
the public interest justified other methods." 

The Journalist, 1 July 2006 



"Richard Fiddis, Managing Director of Experian said... 
'Whilst we would welcome increased penalties, the best 
way to tackle this type of fraud is to tackle it at its source'." 

"Neil Munroe, External Affairs Director, Equifax said... 
'It has been a concern of ours, for some time now, that 
the controls and restrictions on unauthorised buying and 
selling of personal were not stringent enough'." 



Credit Management, 1 July 2006 



"The Government is to begin consultation on bringing in jail 
terms for those convicted of trading in personal data. . . 
it follows calls for a change in the law from Information 
Commissioner, Richard Thomas, who in May said that 
hundreds of journalists were buying secret data." 

Press Gazette, 24 July 2006 



"The noose is tightening on those found guilty of selling data 
illegally, following the launch of a Government consultation 
this week into whether the offence should be punishable by up 
to two years in prison." 



Precision Marketing, 28 July 2006 



"You could also get a complete itemised bill until a few 
months ago, when the Information Commissioner 
threatened custodial sentences. The work was all outsourced 
and there was one firm that was probably making £8,000 a 
week. It became a basic check... Papers have their 'dark arts' 
reporters and many editors don't want to know, but what 
was a flood of stories stood up this way is now a trickle." 



The Independent, 10 August 2006 



"A former tabloid investigative journalist said 
'The Information Commissioner's report that came out 
four or five months ago gave every detail, cough and 
spit of what journalists had been up to'. Then every single 
private investigator in town 'said, No more. We're not 
doing this for journalists'." 



Press Gazette, 10 August 2006 



"In a report recently published by the Information 
Commissioner's Office there was another frightening 
revelation: the existence of a 'blagger's handbook'." 

The Guardian, 11 August 2006 



"One private investigator revealed last week that most of his 
clients who wanted blagging carried out were legal or 
commercial firms. 'Blue chip companies are big players' he 
said. 'They want what they call due diligence, which means a 
full run down on whoever they are dealing with. But there is 
no information that you cannot obtain if you have the money'. 



Sunday Times, 13 August 2006 



"Occasionally, all newspapers that turn over stones 
will need to do exceptional things and need that freedom 
if they are to be effective watchdogs. But such 
investigations can't be generalised trawls for titbits, 
a covert sweep for something or other, even if 
only a Palace gossip paragraph. Condone that and the 
kind of seamy wheezes alleged here will poison 
the well for all journalism." 



Observer, 13 August 2006 



"Privacy shouldn't be sold to the highest bidder." 



J 



Lord Ashcroft KCMG in the Spectator, 2 September 2006 



" 'Where someone lives, who they are, who their friends 
and family may be' is hardly confidential information. 
It is common currency that is easily discovered by talking 
to neighbours, looking at the electoral register or 
searching the Land Registry, as anyone is entitled to do. 
To propose imprisonment for reporters - and insurers, 
solicitors and private investigators - who obtain such 
details would be laughable if it were not so sinister." 

The Sunday Times, 29 October 2006 



"It could all too easily prevent investigative journalists 
looking at personal data in pursuit of a public-interest story; 
deter whistle-blowers from revealing malpractice; and 
blow wide open the confidentiality that protects the journalist 
and his source." 




The Times, 1 November 2006 



The recommendations 



The recommendations in 'What price privacy?' sought to tackle the illegal trade in 
confidential personal information on a number of levels. The main recommendation in 
the report was the introduction of a two year prison sentence but it also called 
for key players and other potentially influential bodies to take steps to reduce demand 
and raise awareness of the problem. 



A custodial sentence 



"The Information Commissioner recommends an amendment to 
section 60(2) of the Data Protection Act 1998, increasing the 
penalty for Section 55 offences committed under the Act to a term 
of imprisonment not exceeding two years, or to a fine, or to both, 
for convictions on indictment; and to a term of not exceeding 
six months, or to a fine, or to both, for summary convictions. The 
Information Commissioner calls on the Lord Chancellor, as 
the Minister responsible for data protection policy, to introduce 
the necessary legislation into Parliament as quickly as possible" 



On the 24 July 2006 the Department for Constitutional Affairs launched the Government's 
consultation "Increasing penalties for deliberate and wilful misuse of personal data". 
The consultation document makes specific reference to 'What price privacy?' and its 
findings and acknowledges that the current penalties contained in Section 60 of 
the Act are not sufficiently strong to stop the illegal trade in confidential personal data. 



In line with the recommendations and reasoning in 'What price privacy?' the Government 
proposes to amend Section 60 of the Data Protection Act 1998 to introduce the sanction 
of 6 months imprisonment on summary conviction (increasing to 1 year in England 
and Wales when Section154 of the Criminal Justice Act 2003 comes into force) and 
2 years imprisonment on conviction on indictment. The consultation paper seeks views 
on whether the increased sanction is proportionate and would be an effective deterrent 
to those unlawfully trading in or wilfully misusing personal data. 



The Information Commissioner has responded to the consultation supporting the proposals. 
The consultation closed on 31 October 2006 but at the time of writing the outcome 
is not known. Nevertheless the Commissioner is confident that the proposals will have 
received widespread support and looks forward to continuing dialogue with the 
Department for Constitutional Affairs as it seeks to take them forward. 




Stifling demand 

'What price privacy?' identified the main players who have it within their power to stem 
the underground traffic in confidential personal information by reducing demand. Specific 
recommendations were addressed to each organisation and their response requested. 



Security Industry Authority (SIA) 

'What price privacy?' identified unscrupulous tracing agents as one of the main contributors 
to the illegal trade in confidential personal information. All such private investigators will 
eventually be subject to licensing by the Security Industry Authority under the Private 
Security Industry Act 2001 . As such the Information Commissioner recommended that: 



"...the SIA should include a caution or conviction for a Section 
55 offence among its grounds for refusing or revoking the licence 
of a private investigation agency" 



The proposed licensing of the private investigation sector will not be introduced until 
the publication of a Regulatory Impact Assessment which will set out proposals 
for licensing. The inclusion of Section 55 offences as a ground for refusing or revoking 
licences would form part of any consultation. 



The SIA have written to the Information Commissioner supporting the report and his 
proposals for increased penalties. The SIA have clarified that they consider 
Section 55 offences as a risk associated with the private investigation sector which 
would merit consideration as an offence that leads to the refusal or revocation 
of a license. The SIA have also indicated that they are likely to consider offences under 
Section 55 as serious offences which may lead to the refusal of a license for longer 
than any sentence restrictions. 



The Commissioner has written to the Home Secretary to urge that the necessary 
Regulatory Impact Assessment should be conducted with urgency. 



Association of British Investigators (ABI) 



The ABI describes itself as the leading professional body working with investigators 
to promote members and the profession. In a further attempt to influence private 
investigators the information Commissioner recommended that: 



..the Association of British Investigators should: 

■ Condemn unequivocally any activity which breaches Section 55 

■ Expel any member cautioned or convicted under Section 55 

■ Publicise this report to its membership 

■ Organise training to make sure that its members do no inadvertently 
break the law 

■ Extend the National Occupational Standard to include specific 
reference to Section 55 



Support the proposal outlined above that the SIA should refuse or 
revoke a private investigators licence for anyone convicted or 
cautioned for a Section 55 offence" 



The ABI have responded positively to the Information Commissioner's recommendations. 
The ABI have condemned any activity by their members which breaches Section 55, 
have disciplinary procures in place to expel members cautioned or convicted under 
Section 55, have brought the report to the attention of their members using an email 
circular, organise data protection training for members at branch and national level, 
feature data protection articles in their magazine and support the proposal that that the 
SIA should refuse or revoke licences for anyone cautioned or convicted of a Section 55 
offence. However the ABI have brought to the Commissioner's attention the fact that 
they do not have power to extend the relevant National Occupational Standard as it is 
the responsibility of the Skills for Security group. 



The ABI are have called for the Information Commissioner to produce guidance on when 
information can legitimately be disclosed to private investigators as they believe that 
there is currently a lot of misunderstanding in this area with information being withheld 
where it could legally be disclosed. The Commissioner has previously issued guidance on 
debt tracing and collection and will update this in due course. He will also consider 
whether work on further guidance on disclosures to private investigators is warranted. 



World Association of Professional Investigators (WAPI) 

After the report was published the Information Commissioner received comments 
from WAPI and subsequently made the same recommendations to them as were put 
to the ABI. WAPI has stressed that the governing council is totally committed to 
compliance with all law and regulation, has brought the report to the attention of all 
its members and has a code of ethics in place where members convicted of 
a Section 55 offence will be expelled subject to an appeal to the governing council on 
the grounds that the breach was in the public interest for the prevention and detection 
of crime. WAPI do not believe that members should be expelled for a caution alone. 

The Information Commissioner has some concerns that WAPI could go further in 

their condemnation of the illegal trade and could be clearer about their intention to expel 

those convicted or cautioned of a Section 55 offence. 

WAPI consulted their membership and reported some of the responses to the Information 
Commissioner. Amongst their membership's concerns was that the proposed 
custodial sentence is contrary to the current legal climate of reduced sentences for 
those convicted of more serious crimes. The Information Commissioner's intention is 
only that the courts should have the option of a custodial sentence available to 
them. He would not expect the courts to impose such a sentence for every offence 
committed under Section 55 but only to do so where it is appropriate given the 
particular circumstances before them. 

WAPI are concerned that the Information Commissioner is targeting the investigation 
sector while crime through fraud and identity theft continues to soar. In that context 
WAPI has called on the Information Commissioner to press Parliament for lawful access 
to data in appropriate situations instead of targeting investigators. The Information 
Commissioner acknowledges that investigators can perform a valuable service and does 
not wish to condone the activity of absconded debtors or others involved in illegal 
activity. However 'What price privacy?' revealed that middlemen employed in the private 
investigation trade are at the heart of the illegal market in confidential information 
and it is those unscrupulous investigators that the proposals seek to target. 

The Information Commissioner recognises the call for lawful access to relevant personal 
information but also notes that there is already much information that investigators can 
legitimately obtain on behalf of their clients within the existing legal framework. 



Press Complaints Commission and 
Code of Practice Committee of Editors 



The Press Complaints Commission monitors and adjudicates on disputes about breaches 
of the Editors' Code of Practice, which sets out the conduct that the press have 
agreed to follow as part of a self regulatory system. The Information Commissioner 
fully supports effective self regulation of the press and firmly believes in freedom 
of expression. In an effort to ensure that all journalists behave in an acceptable way the 
Information Commissioner recommended that: 




"...the Press Complaints Commission (and its associated Code of Practice 
Committee of Editors) should take a much stronger line to tackle any 
nvolvement by the press in the illegal trade in personal information' 




The Press Complaints Commission has confirmed to the Information Commissioner in 
writing, on public platforms and in a press release that journalists must act within 
the law, having regard for the Data Protection Act 1998 and the proper use of the 
public interest exemption on which they can rely. The Press Complaints Commission has 
agreed to keep repeating this message wherever the opportunity arises. The 
Commissioner hopes that this will be done as loudly and actively as possible. 

The UK press system of self regulation means that the standards the press operate to and 
any associated guidance must have the approval of industry in the form of the Code of 
Practice Committee of Editors. The Information Commissioner has engaged directly with 
the Chairman and Secretary of the Code of Practice Committee of Editors. He has discussed 
the possibility of amending their Code of Practice to make it clear that it is unacceptable, 
without an individual's consent, to obtain information about their private life by bribery, 
impersonation, subterfuge or payment for information clearly obtained by such means. 
This would not apply where it can be demonstrated that such activity is justified in the public 
interest. Unfortunately, however, no concrete proposal have so far been brought forward. 

The Commissioner has also raised the possibility of the Press Complaints Commission 
producing further, simple guidance for journalists with the assistance of his office. The 
Code of Practice Committee of Editors has indicated its support for the production of 
clear guidance for the attention of senior management in the industry. This guidance would 
be included in the Editor's Codebook which supplements the Code and be posted on the 
Editor's Code website. The Committee has not agreed to the change to the Code suggested 
by the Information Commissioner. However, the Committee has indicated that it will keep 
the Code under review and that the Information Commissioner can put forward a suggestion 
for a change to the Code through the usual channels. The Commissioner has written to 
the Code of Practice Committee to reiterate his suggested change to the wording of the Code. 



Office of Fair Trading 



The Information Commissioner was clear in 'What price privacy?' that he in no way 
condones the behaviour of debtors who abscond without informing their creditors and 
supports efforts to develop legitimate means for tracing debtors in which a proper 
balance is struck between the privacy rights of individuals and the legitimate interests 
of those to whom money is owed. 



The Information Commissioner recommended that: 




"the Office of Fair Trading should amend its 2003 Debt 
Collection Guidance - which is directly linked to fitness 
to hold a consumer credit license - to include an explicit 
condemnation of activities that breach Section 55" 




The Office of Fair Trading have unequivocally condemned any activities that breach 
Section 55 of the Act and confirmed that a clarification will be placed in the 2003 Debt 
Collection Guidance that such activity is an unfair business practice that would be taken 
into account when deciding on fitness to hold a consumer credit licence. The Information 
Commissioner will ensure that the Office of Fair Trading is made aware when there are 
relevant convictions of persons who hold a consumer credit licence. 



Raising awareness and standards 

The Information Commissioner has a duty to promote good data protection practice by 
organisations and raise awareness amongst individuals. In order to raise awareness 
of the nature and the extent of the illegal trade in personal information and to encourage 
organisations to protect themselves and their customers the report was circulated to 
a range of government departments, public bodies, trade and professional associations, 
utility companies, telecommunications providers, financial institutions, credit reference 
agencies and law firms. 



In addition the Information Commissioner recommended that: 



■ 



all relevant regulatory and professional bodies should 
take a strong line to tackle any involvement in the illegal trade 
in personal information" 



Copies of the report were circulated to the media, finance and professional bodies 
identified in the report asking: 



What steps will you take to publicise the report among your members 
or those you regulate? 

Are you willing to condemn unequivocally the commission of offences 
under Section 55 of the Data Protection Act, and if so, how will you do this? 

In six months time, will you let the Information Commissioner have 
details of any changes made or in prospect to the relevant disciplinary 
rules, codes of practice or other instruments (statutory and self 
regulatory), with the aim of improving your control or influence over 
the illegal buying and selling of information. 



The responses received have been largely positive and are summarised below. 



Media bodies 

The BBC has committed to making their editorial community aware of the report at 
their monthly meetings and will be introducing specific guidance to require any programme 
or journalist purchasing personal data to seek approval from a senior editorial figure. 
However, the BBC has not unequivocally condemned Section 55 offences the 
commission of which they feel might be necessary in some cases and does not support 
the proposed prison sentence. The BBC believes that the proposals could potentially 
subject their journalists to serious criminal charges where they are acting in the public 
interest in the preparation or dissemination of story. The Information Commissioner 
has written to the BBC to remind them that he is not proposing the introduction of any 
new criminal offences and that there exists a defence in the Act for anyone acting 
in the public interest. He has urged them to reconsider their stance. 

Ofcom have publicised the report on their website where they have also unequivocally 
condemned the illegal buying and selling of information. In addition Ofcom have 
demonstrated to the Information Commissioner their commitment to good information 
handling internally. 

The National Union of Journalists drew attention to the report in their official trade 
publication which is circulated to all members and defended the right of journalists to 
obtain information where it is in the public interest. The Union has written to the 
Information Commissioner stressing their long standing commitment to journalists only 
obtaining information by straightforward means unless they can demonstrate that 
they are acting in the public interest. The Union is currently considering an addition to 
their code of conduct to require journalists not to publish or obtain information directly 
or indirectly which would breach Section 55. 



In addition the Union has supported custodial sentences provided that the higher 

penalties are reserved for those who feed and encourage the illegal trade by instructing 

journalists to break the law when there is no overriding public interest to do so. 

The Union believes that the illegal trade is encouraged by cost cutting by the industry 

leading to publications devoting fewer resources to investigative journalism and 

also because of disillusionment amongst journalists about the Freedom of Information 

Act 2000 providing a ready source of information. 

The Union has stressed that journalists should not be scapegoats for newspaper 
proprietors and managers who pressure them into breaking the law. 

The Newspaper Publishers' Association, Scottish Newspaper Publishers' 
Association, Newspaper Society, Scottish Daily Newspaper Society, Periodical 
Publishers Association and Society of Editors responded to the Commissioner's 
recommendations as one on behalf of the newspaper and magazine industries making 
it clear that no newspaper publisher would condone any illegality. They have 
stressed that the industry takes the issues reported in 'What price privacy?' very 
seriously and that they perceive their role as spreading greater awareness and 
understanding amongst journalists of data protection issues and the potential 
consequences of breaching the law. Building on the data protection guidance already 
issued by the Press Complaints Commission (PCC) and working with the Information 
Commissioner (ICO) they propose to: 

1 . encourage individual publishers to draw the information contained 
in 'What price privacy?' to the attention of senior management; 

2. distribute through industry associations to each of their members 
simple guidance prepared by the ICO about the terms of the Act, and 
ask them to disseminate it to their journalists; and 

3. assess what further steps need to be taken to publicise this guidance 
once the exercise has been completed. 

The industry recognises that the situation needs constant review and as such has 
indicated that the Code of Practice Committee of Editors, as mentioned above in 
connection with the PCC, will keep the terms of the code under review and would be 
ready to receive further representations from the Information Commissioner. 

Attached to the industry's response to 'What price privacy?' was their submission to the 
Government's consultation on increasing penalties for the deliberate and wilful misuse 
of personal data. While the response was not directed at the Information Commissioner 
it is useful to note some of its key points here as the industry argues against the introduction 
of a possible custodial sentence as an addition to the existing sanction of fines. 



The industry believes that a custodial sentence will have a serious chilling effect 
on investigative journalism and that given the importance to democracy of freedom 
of speech, and in line with the precedent of the European Court concerning the 
press, an overwhelming case needs to be made for the introduction of custodial 
sentences. The industry maintains that no such case has yet been made by 
either the Information Commissioner or the Government. 

The industry argues that the introduction of prison sentences would require the 
existing public interest exemption at Section 55 to be revised. Currently to enjoy the 
exemption at Section 5 5(2)(d) journalists have to be certain that they are acting 
in the public interest before obtaining or procuring any personal information which does 
not allow for situations where they are acting in the reasonable belief that their line 
of investigation is in the public interest. 

The industry proposes that the problem of journalists' involvement in the illegal trade in 
confidential personal information could be addressed by greater fines and more 
prosecutions in the Crown Court coupled with greater education for journalists about 
the Data Protection Act 1998. 

Finance industry 

The Association of British Insurers (ABI) has indicated that insurers will not tolerate 
breaches of Section 55 and supports the regulation of the private investigation industry 
to ensure the highest ethical standards are present in investigation. All ABI members 
have been made aware of 'What price privacy?' and the ABI data protection working party 
is currently producing industry guidance on the use of private investigators in 
consultation with the Information Commissioner's Office. 

The British Bankers' Association (BBA) has welcomed 'What price privacy?', supports 
the proposal for an increased penalty and condemns Section 55 offences unequivocally. 
The BBA's data protection advisory panel have made all their contacts aware of the 
report and of the Financial Services Authority's stance (see below). The BBA has already 
produced practical data protection guidance for banks which makes employees aware 
of their obligations and stresses the importance of security to the banking industry. 
In addition the BBA will be producing further guidance on keeping customer information 
safe and will consult with the Information Commissioner in its production. 

The Consumer Credit Association (CCA) has circulated copies of 'What price privacy?' 
to all their members, have summarised the contents of the report in their newsletter 
and included the key findings in their regular training seminars. The CCA condemns 
the illegal trade in confidential personal information and their existing code of practice 
requires compliance with the Data Protection Act 1998. 



The Consumer Credit Trade Association (CCTA) supports the Commissioner's 
proposals and condemns Section 55 offences. The CCTA are rewriting their code of 
practice which will include specific reference to Section 55 offences and their 
condemnation of them. The finished code will be circulated to all CCTA members. 

The Credit Services Association (CSA) supports the recommendations in 'What price 
privacy?' and has circulated a copy to all their members with a covering letter condemning 
the Section 55 offences. The CSA code of practice makes clear that members must 
only use legally obtained information and they have amended the code to include specific 
reference to Section 55 offences. The CSA has also issued best practice guidance for 
members on Section 55. 

The CSA calls for better legal access to relevant information to allow members to trace 
debtors and highlights that Data Disclosure Orders only apply to judgment debtors. 

The Finance and Leasing Association (FLA) has unequivocally condemned 
Section 55 offences. It has publicised 'What price privacy?' by sending a link to it to all 
its members by email, featuring an article in its monthly newsletter and ensuring 
the report is on the agenda of its compliance forum. In addition the FLA is currently 
looking into the possibility of changes to its Lending Code to further suppress 
the illegal trade in confidential personal information. 

The Financial Services Authority (FSA) has unequivocally condemned Section 55 
offences. Under the Financial Services and Markets Act 2000 firms are required 
to meet threshold criteria in order to remain authorised. One of the threshold criteria is 
that firms act in a fit and proper way. The FSA have confirmed to the Information 
Commissioner that acting in a fit and proper way involves meeting all legal and regulatory 
obligations including complying with the Data Protection Act. The FSA have circulated 
their letter to the Information Commissioner to the trade associations of the firms 
they regulate to make their position clear. The Information Commissioner will be making 
the FSA aware of any regulated firms that are convicted of Section 55 offences. 



Others 



Local Government 

The Local Government Association and Welsh Local Government Association will 
be writing to the chief executives of all local authorities in England and Wales drawing 
'What price privacy?' to their attention. The letter will remind authorities that breaches 
of Section 55 are criminal offences and it will also call for them to be vigilant 
concerning attempts to obtain the information they hold. In addition the letter will set 
out some questions for councils to consider when employing tracing agents: 

Have you pursed all available routes? 

If so, what legal routes can a tracing agent pursue? 

Have you asked the tracing agent what information 
sources will be used? 

Will the work to be done outsourced - if so who to? 

The Northern Ireland Local Government Association has circulated 

'What price privacy?' to all Northern Ireland councils condemning the commission 

of Section 55 offences and is producing a policy on the privacy of information 

for councils. The Convention of Scottish Local Authorities has brought the report 

to the attention of a number of relevant professional bodies in Scotland. 

Law Societies 

The Law Society and the Law Society Scotland have condemned the commission of 
Section 55 offences and featured articles about 'What price privacy?' in their newsletters 
to raise awareness of the problem and the issues for solicitors. The Incorporated Law 
Society of Northern Ireland has also condemned the commission of Section 55 
offences, has included an article in their journal to raise awareness of the problem and 
has committed itself to covering Section 55 offences in future data protection 
related training events. 



Police 



The Association of Chief Police Officers (ACPO) supports the proposals in the 
report and has unequivocally condemned the commission of Section 55 offences. In an 
effort to increase control over the illegal trade in confidential personal information 
ACPO have included unauthorised disclosures in the annual risk assessment carried out 
by the Police Service and the Serious and Organised Crime Agency. Furthermore 
in an effort to reinforce the IT monitoring that forces already have in place a code of 
professional standards has been developed which includes confidentiality as a key 
principle. Guidance to accompany the code makes clear that if officers are unsure if 
they should access or disclose information they should always consult with their 
manager or the department dealing with data protection and freedom of information. 
The guidance also makes it clear that information is not to be provided to third parties 
including requests from family and friends, approaches from private investigators and 
unauthorised disclosure to the media. The code and guidance are currently being 
considered for approval by the Police Advisory Board. In addition the Chairman of ACPO 
has written to the data protection officers of all forces in England, Wales and Northern 
Ireland drawing their attention to the report, reminding them to be vigilant, have 
thorough checking systems in place and create an environment where staff understand 
the reasons for integrity and data auditing. 

The only other significant responses are from the Association of Scottish Police 
Superintendents and the Police Federation for Northern Ireland which have 
condemned the commission of Section 55 offences and made 'What price privacy?' 
available to members and staff. The Association of Scottish Police Superintendents has 
highlighted that all Scottish Police forces have polices and procedures for information 
security and progress investigations of data misuse vigorously. The Police Federation of 
Northern Ireland have stressed that their staff are contractually obliged not to disclose 
information to sources outside the organisation. 

Consumer bodies 

The Information Commissioner also circulated 'What price privacy?' to consumer bodies 
asking for any further evidence that they have of the illegal trade. This included the 
National Consumer Council and its regional equivalents, BBC consumer programmes, 
WHICH?, Citizens Advice and Citizens Advice Scotland. There has been no evidence 
presented to the Commissioner so far but he calls on these bodies to remain vigilant 
and where they are in possession of evidence to make his office aware of it. 



Conclusions 



The Information Commissioner welcomes the generally positive response from the bodies 
mentioned in 'What price privacy?'. The support for the report and its proposals has 
been substantial. The action that organisations have taken or intend to take has raised 
the profile of Section 55 offences while at the same time strengthening the sanctions 
for those that engage in this illegal and damaging activity. This is a welcome contribution 
towards addressing the problem of the illegal trade in confidential information. 

The Government's consultation on introducing prison sentences for Section 55 offences 
was particularly encouraging. The Information Commissioner continues to believe 
that there is a pressing need for the introduction of an option for the courts to hand 
down prison sentences for Section 55 offences in addition to the penalties already 
available to them. It will though be for the courts to decide what punishment to hand 
down in a particular case. We would expect the prison to be reserved for only the most 
serious cases. We will work with the Government in support of their proposals and 
stand ready to provide them, or a Parliament with any further information or arguments 
that may be needed if the proposals are to be taken forward. 

The reaction of some sections of the press - both editorial and proprietorial - that the 
proposals for custodial sentences should seemingly apply to others but not journalists is 
disappointing. The Information Commissioner fully recognises the importance of freedom 
of expression. But he considers that press representatives have ignored or not taken 
sufficiently into account the existing exemptions within the legislation to ensure that the 
press and other media are able to function lawfully in pursuit of legitimate investigative 
journalism. Public interest and other defences are already available. Freedom of speech 
is not freedom to break the law by bribery or deception where there is no public interest 
justification. It is difficult to imagine a prosecution - let alone a conviction of any journalist 
able to show that he or she was pursuing a story to prevent or detect crime, to expose 
public impropriety or was otherwise acting in the public interest. There is already 
prospect of a criminal conviction and an unlimited fine facing those who fish for tittle- 
tattle about public and private figures or who otherwise cannot justify their activities, 
but these deterrents clearly have not worked. It must be stressed that the proposals do 
not call for the creation of a new offence and will not make criminal any activity by the 
press or other media that is not already criminal. A further safeguard is that only the 
Commissioner or the Director of Public Prosecutions may bring a prosecution. 

More generally, where it is in the public interest we will ensure that the Security 
Industry Authority, the Office of Fair Trading and the Financial Services Authority are 
informed about licensed or authorised organisations that have not acted in a fair and 
proper manner and may merit investigation and sanction under their regulatory regimes. 
This additional sanction should be a significant deterrent for businesses tempted to use 
illegally obtained information. 



We are pleased that the report and the issues it raises have been widely circulated by 
professional bodies, trade associations and others. Whilst some responses may be a 
little disappointing most organisations we have contacted have commendably taken 
further steps to stifle the illegal trade in confidential personal information, for example 
by amending their codes or producing guidance. We will draw the Government's 
attention to the calls from some of those bodies for better legal access to relevant 
information in particular to trace absconded debtors. 

There is still further work to be done to reduce the demand for illegally obtained 
confidential information. This work will be ongoing. We will continue to track down and 
prosecute offenders. We will continue to press the Government to introduce the 
option of a prison sentence and see this progress report as supporting that goal. We will 
continue to raise awareness and we will encourage and work with any organisation 
that wants to raise standards or produce clear guidance on data protection obligations. 
In particular we will be working closely with the media on the development of relevant 
guidance and standards for journalists. 
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